You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
127 lines
4.3 KiB
127 lines
4.3 KiB
# coding=utf-8
|
|
from __future__ import absolute_import
|
|
|
|
from octoprint.users import FilebasedUserManager, User
|
|
from octoprint.settings import settings
|
|
import ldap
|
|
import uuid
|
|
|
|
|
|
class LDAPUserManager(FilebasedUserManager):
|
|
#Login phase :
|
|
# - findUser called, if it return a user
|
|
# - chaeckPassword called, if it return True
|
|
# - login_user called with User returned by previous findUser
|
|
|
|
def checkPassword(self, username, password):
|
|
try:
|
|
connection = self.getLDAPClient()
|
|
|
|
username = self.escapeLDAP(username)
|
|
dn = self.findLDAPUser(username)
|
|
connection.bind_s(dn, password)
|
|
connection.unbind_s()
|
|
|
|
user = FilebasedUserManager.findUser(self, username)
|
|
if not user:
|
|
self._logger.debug("Add new user")
|
|
self.addUser(username, str(uuid.uuid4()), True)
|
|
return True
|
|
|
|
except ldap.INVALID_CREDENTIALS:
|
|
self._logger.error("LDAP : Your username or password is incorrect.")
|
|
return FilebasedUserManager.checkPassword(self, username, password)
|
|
except ldap.LDAPError, e:
|
|
if type(e.message) == dict:
|
|
for (k, v) in e.message.iteritems():
|
|
self._logger.error("%s: %sn" % (k, v))
|
|
else:
|
|
self._logger.error(e.message)
|
|
return False
|
|
|
|
def changeUserPassword(self, username, password):
|
|
#Changing password of LDAP users is not allowed
|
|
if FilebasedUserManager.findUser(self, username) is not None:
|
|
return FilebasedUserManager.changeUserPassword(self, username, password)
|
|
|
|
def findUser(self, userid=None, session=None):
|
|
local_user = FilebasedUserManager.findUser(self, userid, session)
|
|
#If user not exists in local database, search it on LDAP
|
|
if userid and not local_user:
|
|
if(self.findLDAPUser(userid)):
|
|
#Return a fake user instance
|
|
return User(userid, str(uuid.uuid4()), True, ["user"])
|
|
|
|
else:
|
|
return None
|
|
|
|
else :
|
|
self._logger.debug("Local user found")
|
|
return local_user
|
|
|
|
def findLDAPUser(self, userid):
|
|
ldap_search_base = settings().get(["accessControl", "ldap_search_base"])
|
|
userid = self.escapeLDAP(userid)
|
|
|
|
if ldap_search_base is None:
|
|
self._logger.error("LDAP conf error")
|
|
return None
|
|
|
|
try:
|
|
connection = self.getLDAPClient()
|
|
|
|
result = connection.search_s(ldap_search_base, ldap.SCOPE_SUBTREE, "uid=" + userid)
|
|
connection.unbind_s()
|
|
if (result is None or len(result) == 0):
|
|
return None
|
|
|
|
#Get the DN of first user found
|
|
dn, data = result[0]
|
|
return dn
|
|
|
|
except ldap.LDAPError, e:
|
|
if type(e.message) == dict:
|
|
for (k, v) in e.message.iteritems():
|
|
self._logger.error("%s: %sn" % (k, v))
|
|
else:
|
|
self._logger.error(e.message)
|
|
return None
|
|
|
|
def escapeLDAP(self, str):
|
|
reservedStrings = ['+','=','\\','\r','\n','#',',','>','<','"',';']
|
|
for ch in reservedStrings:
|
|
if ch in str:
|
|
str = str.replace(ch, '\\' + ch)
|
|
return str
|
|
|
|
def getLDAPClient(self):
|
|
ldap_server = settings().get(["accessControl", "ldap_uri"])
|
|
ldap_verifypeer = settings().get(["accessControl", "ldap_tls_reqcert"])
|
|
if ldap_server is None:
|
|
self._logger.error("LDAP conf error")
|
|
Exception("LDAP conf error, server is missing")
|
|
|
|
connection = ldap.initialize(ldap_server)
|
|
if (ldap_server.startswith('ldaps://')):
|
|
verifypeer = ldap.OPT_X_TLS_NEVER
|
|
if ldap_verifypeer == 'demand':
|
|
verifypeer = ldap.OPT_X_TLS_DEMAND
|
|
connection.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, verifypeer)
|
|
try:
|
|
connection.start_tls_s()
|
|
except:
|
|
pass
|
|
|
|
return connection
|
|
|
|
def ldap_user_factory(components, settings, *args, **kwargs):
|
|
return LDAPUserManager();
|
|
|
|
__plugin_name__ = "Auth LDAP"
|
|
__plugin_version__ = "1.0.0"
|
|
|
|
def __plugin_load__():
|
|
global __plugin_hooks__
|
|
__plugin_hooks__ = {
|
|
"octoprint.users.factory": ldap_user_factory
|
|
}
|
|
|